Supported tokens/smart cards

[salinity]

Hi,

I'm helping a friend deploy openvpn and am interested in inexpensive Smart Card solutions for two-factor use with openvpn. I'd like to deploy the vpn to perhaps 20 remote users and have usb tokens or smart cards that allow me to be my own certificate authority. I'd like to pre-generate X509s for each remote user and have my friend hand them out to those who need remote access.

TIA for any advice